CVE-2026-98993 is a Linux kernel vulnerability involving improper handling of the MNT_UMOUNT flag during mount namespace cloning. The flaw causes mounts that have been lazily unmounted but are still referenced to incorrectly inherit the MNT_UMOUNT flag, leading to various mount namespace inconsistencies, including leaked mounts, unmounting errors, and potential use-after-free conditions. This issue affects specific linux-aws kernel versions and has a high severity rating with a CVSS score of 7.8.
CVE-2026-98992 is a vulnerability in the Linux kernel's namespace handling where the function may_copy_tree() improperly copies an unmounted mount tree. This occurs because the function accepts mounts whose roots are nsfs or pidfs files before verifying if they are mounted, allowing recursive copying of unmounted mount stacks. The issue arises when bind mounting a namespace file descriptor that was lazily unmounted but still kept alive by a file descriptor, leading to unintended copying of the entire unmounted mount stack. The fix involves refusing to recursively walk unmounted mount trees, returning an error instead.
CVE-2026-98984 is a Linux kernel vulnerability involving the dcache subsystem where a mountpoint can be incorrectly placed on a dentry that is in the process of being removed. This occurs due to a race condition between detach_mounts() and d_delete() operations, allowing a bind mount of a directory being removed to be moved beneath an existing mount, resulting in a mountpoint on a removed directory that cannot be detached. The issue has been resolved by ensuring proper locking and checks to prevent mounts on dentries being removed.
A vulnerability in the Linux kernel's unshare system call can cause active namespace references to be dropped incorrectly when set_cred_ucounts() fails. This leads to the caller's namespaces losing references and not being listed by listns(), potentially causing inconsistent namespace state.
CVE-2026-98982 is a high-severity vulnerability in the Linux kernel affecting certain versions where a pseudo dentry can become the root of a mount. This occurs due to improper handling of pseudo dentries (used for pipes, sockets, etc.) that are not meant to be mount roots but can be bind-mounted via /proc/self/fd/<fd>. This leads to a use-after-free condition during mount namespace operations. The vulnerability allows an attacker with local privileges to cause a high-impact compromise including confidentiality, integrity, and availability.
CVE-2026-98980 is a high-severity vulnerability in the Linux kernel affecting certain versions of the linux-aws kernel. It involves the namei subsystem where overmounted entries can be revealed during a reference walk (refwalk). This occurs because refwalk does not properly detect unlinked mountpoints, potentially exposing underlying filesystem entries that should be hidden. The issue arises from differences in how lookups and refwalk handle dentries that are unlinked or detached from mounts. The vulnerability has been addressed by adding checks to ensure that entries marked as unlinked and unhashed are not erroneously revealed during refwalk.
A vulnerability in the Linux kernel's cgroup cpuset subsystem was addressed by modifying the is_in_v2_mode() function to avoid accessing a potentially stale pointer, which could lead to use-after-free conditions. The fix introduces a new cpuset_v2_mode flag to safely determine the mode without dereferencing the root pointer directly.
A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The flaw allowed leaking of btrfs_uring_encoded_data if a request returned -EAGAIN and was cancelled or the io_uring ring exited before reissue. This occurred because io_uring did not free driver PDU allocations on cleanup properly. The issue affected multiple specific Linux kernel versions.
A vulnerability in the Linux kernel ext4 filesystem driver allows a kernel crash due to a NULL pointer dereference when large folios are enabled on encrypted inodes. This occurs because enabling the encrypt feature on a mounted filesystem bypasses checks that disable large folios, leading to a crash during encrypted data writes. The issue affects kernel versions from 6.19 through 7.2 and was fixed by disabling large folios on encrypted inodes in version 7.3, where the code was refactored.
A vulnerability in the Linux kernel's AMD GPU driver was resolved. The issue involved scheduling thermal work on a queue that was not initialized when Dynamic Power Management (DPM) was disabled via the amdgpu.dpm=0 module parameter. This could lead to improper handling of thermal work scheduling.
A vulnerability in the Linux kernel's ksmbd component related to lease break handling has been resolved. The issue involved holding a read lock (ci->m_lock) while waiting for a lease break acknowledgment, causing a deadlock scenario that delayed lease break resolution by up to 35 seconds. This resulted in significantly increased operation times in tests with leases enabled. The fix changes the locking strategy to avoid holding the lock during the wait, preventing the deadlock.
A vulnerability in the Linux kernel's irqchip/gic-v4 component was resolved. The issue occurs when the kernel parameter kvm-arm.vgic_v4_enable=1 is set on a system lacking an MSI controller device tree node and GICv4, causing a NULL pointer dereference and kernel panic. The fix involves disabling vLPI support at initialization if the host has no ITS, preventing the kernel from accessing a NULL gic_domain pointer.
A vulnerability in the Linux kernel's freevxfs filesystem code caused a kernel crash when encountering unknown typed-extent types during ioctl(FIBMAP) operations on regular files. The issue was due to the vxfs_bmap_typed() function calling BUG() on unexpected extent types, leading to a kernel panic. The vulnerability has been resolved by replacing the BUG() call with WARN_ON_ONCE() and returning 0 to fail cleanly without crashing the kernel.
A vulnerability in the Linux kernel's iwlwifi driver related to WoWLAN suspend behavior without netdetect configuration has been resolved. The issue involved the driver issuing a WARN_ON() warning when suspending WoWLAN without an active network connection or netdetect configured. The fix removes this warning and ensures the driver cleanly handles suspension in this scenario.
A vulnerability in the Linux kernel's device mapper ioctl interface allowed an out-of-bounds read due to improper handling of buffer sizes in struct dm_ioctl. This flaw could cause a read past the allocated buffer by seven bytes when userspace requests the minimum buffer size. The issue was fixed by clamping the data_start pointer to the actual buffer size. This vulnerability is not exploitable by unprivileged users as it requires root access.
A vulnerability in the Linux kernel's xen/netfront driver causes a memory leak when the function xennet_fill_frags() fails due to response chains exceeding the skb's fragment capacity. The skb buffer is not properly freed, leading to resource leakage. This issue affects specific Linux kernel versions and has been fixed in later releases.
CVE-2026-99056 is a high-severity vulnerability in the Linux kernel's strparser component. It involves a race condition where the __strp_recv function might still be running when the parser is being torn down, potentially leading to a use-after-free (UAF) condition. This issue affects the espintcp user of strparser and could cause crashes or be exploited. The vulnerability has been fixed in multiple Linux kernel commits.
CVE-2026-99030 is a high-severity vulnerability in the Linux kernel's networking code where stale bytes may be left in buffers during skb_copy_and_csum_bits() operations. This occurs when unreadable fragments cause partial copying, leaving uninitialized memory in buffers sent on the network, potentially leaking sensitive data. The issue affects Linux kernel version 6.12 and has been fixed in subsequent commits.
A vulnerability in the Linux kernel's regulator driver for the LTC3676 chip caused reading write-only HRST and CLIRQ registers to trigger unintended hardware resets. These registers are command strobes where writing HRST triggers a hard reset and writing CLIRQ clears interrupts. Reading these registers returns no useful data but fires the command, so a register dump that reads all registers causes the board to reboot unexpectedly. The issue was fixed by making HRST and CLIRQ writable only, preventing reads that cause resets.
CVE-2026-98996 is a Linux kernel vulnerability where the system may silently unmount busy mounts during propagation, causing mounts still in use to be detached. This occurs due to propagate_mount_busy() not properly checking references on certain mount copies, allowing synchronous unmounts to succeed incorrectly. The issue affects multiple Linux kernel versions from 4.1.43 up to and including 4.13. The vulnerability has been fixed in Linux kernel versions 4.2, 4.5, 4.10, 4.12, and 4.13.